Security guidebook · Knowledge map

CISSP knowledge map

Every objective of the CISSP exam outline (effective April 15, 2024), 1.1 to 8.5, pointing to the lesson that teaches it — or logged as a gap where no lesson exists yet. Objectives are numbered and paraphrased in the guidebook’s own words; the outline text itself is never reproduced.

Published 2026-10-09 · generated from the lesson data · 62 of 62 objectives have a lesson

The issuer’s rule, stated once

Full CISSP certification needs five cumulative years of work experience in two or more of the eight domains — a degree or an approved credential can stand in for one year. Passing the exam without the experience makes someone an Associate of ISC2. The lessons teach the bodies of knowledge; they do not confer the certification.

AI in the outline — exam content, not commentary

ISC2’s “Exam Guidance for Artificial Intelligence” (September 1, 2026) maps AI-specific security tasks across all eight domains of the CISSP exam outline (still the April 15, 2024 edition) — examinable topics woven into each domain, not separate AI objectives and not third-party commentary. Each domain section below carries its AI note with links to the AI security track lessons.

Domain 1 — Security and Risk Management 16% of the exam

AI note AI assets shift your risk posture — fold ML models and LLMs into the risk frameworks you already use, govern AI ethics and algorithmic bias, and assess AI vendors the way you assess any third party. See: Governing AI, AI supply chain security.

Objective	Topic	Lesson
1.1	Professional ethics in security work	Professional ethics in security work: the Code is the floor, not the ceiling
1.2	Core security concepts: confidentiality, integrity, availability, and related properties	Core security concepts: the CIA triad and the properties around it
1.3	Security governance: aligning security with business strategy	Security governance: aligning security with business strategy
1.4	Legal, regulatory, and compliance landscape	Legal, regulatory, and compliance: mapping obligations to evidence
1.5	Investigation types and their requirements	Investigation types: which investigation you're in, and what it demands
1.6	Security policy, standards, procedures, and guidelines	Security policy, standards, procedures, and guidelines: the document hierarchy
1.7	Business continuity requirements: business impact analysis and dependencies	Business continuity and disaster recovery: deciding what survives the outage
1.8	Personnel security across hiring, employment, and departure	Personnel security: the human side of the employment lifecycle
1.9	Risk management concepts, end to end	Risk assessment as a worked case
1.10	Threat modeling concepts and methodologies	Threat modeling concepts and methodologies: choosing how to think about what can go wrong
1.11	Supply chain risk management	Supply chain risk management: trusting what you didn't build
1.12	Security awareness, education, and training programs	Security awareness, education, and training: building the learning program

Domain 2 — Asset Security 10% of the exam

AI note Training datasets, pre-trained models, and model weights are high-value assets to classify and handle; protect data integrity across the AI lifecycle and use differential privacy and masking where AI touches PII. See: AI supply chain security, How LLM applications are built and where they are attacked.

Objective	Topic	Lesson
2.1	Identifying and classifying information and assets	Classifying information and assets: the scheme everything else hangs on
2.2	Information and asset handling requirements	Handling requirements: what each classification tier demands
2.3	Secure provisioning: ownership, inventory, asset management	Secure provisioning: ownership, inventory, and the CMDB
2.4	The data lifecycle: roles, collection, location, retention, remanence, destruction	The data lifecycle: from collection to destruction
2.5	Asset retention and end-of-life/support	Retention schedules and end-of-life: when to let go, and how
2.6	Data security controls and compliance	Data security controls: protecting data at rest, in transit, and in use

Domain 3 — Security Architecture and Engineering 13% of the exam

AI note Host AI compute in secure enclaves, validate inputs against prompt injection and adversarial attacks, and engineer in explainability so an AI's decisions stay auditable. See: Prompt injection, the #1 LLM risk, How LLM applications are built and where they are attacked.

Objective	Topic	Lesson
3.1	Secure design principles for engineering	Secure design principles: engineering judgment before controls
3.2	Formal security models	Formal security models: what "secure" means, precisely
3.3	Selecting controls from system security requirements	Selecting controls: from requirements to a defensible set
3.4	Platform security capabilities	Platform security: the ground your architecture stands on
3.5	Assessing vulnerabilities across architecture and system types	Assessing vulnerabilities across the architecture
3.6	Cryptographic solutions: lifecycle, methods, PKI, key management	Applied cryptography: what the primitives do, and how they break, Cryptography: what the primitives do, and what breaks when you misuse them
3.7	Cryptanalytic attack methods	Cryptanalytic attacks: how ciphers fail, and what that teaches
3.8	Site and facility design principles	Site and facility design: security before the first brick
3.9	Site and facility security controls	Site and facility controls: the checklist that holds
3.10	The information system lifecycle	The information system lifecycle: security at every gate

Domain 4 — Communication and Network Security 13% of the exam

AI note Isolate AI training environments with micro-segmentation and zero trust to stop lateral movement, and know how AI-driven NDR finds anomalies that signature-based tools miss. See: Threat modeling AI systems, AI security automation: concepts.

Objective	Topic	Lesson
4.1	Secure network architecture design	Network architecture: drawing the lines attackers must cross
4.2	Securing network components	Network components: hardening everything the architecture trusts
4.3	Secure communication channels	Secure channels: which encrypted path for which traffic, and why

Domain 5 — Identity and Access Management 13% of the exam

AI note Give AI agents and service accounts full identity-lifecycle treatment under least privilege, and use AI — behavioral biometrics, adaptive authentication — to defend your identity estate in turn. See: AI security automation: concepts, How LLM applications are built and where they are attacked.

Objective	Topic	Lesson
5.1	Controlling physical and logical access to assets	Identity and access management: who gets in, and to what
5.2	Identification and authentication strategy	Identity and access management: who gets in, and to what
5.3	Federated identity with third-party services	Identity and access management: who gets in, and to what
5.4	Authorization mechanisms and models	Identity and access management: who gets in, and to what
5.5	Identity and access provisioning lifecycle	Identity and access management: who gets in, and to what
5.6	Implementing authentication systems	Implementing authentication systems: the rollout, not the theory

Domain 6 — Security Assessment and Testing 12% of the exam

AI note Red-team AI systems against evasion and extraction attacks, audit model outputs for exploitable logic flaws, and automate vulnerability management with AI-powered scanning. See: Threat modeling AI systems, AI security automation: concepts.

Objective	Topic	Lesson
6.1	Designing assessment, test, and audit strategies	Assessment strategy: deciding what gets tested, by whom, and how often
6.2	Security control testing methods	Control testing: choosing the method that proves the claim
6.3	Collecting security process data	Security metrics: measuring the program without lying to yourself
6.4	Analyzing test output and reporting	Test analysis and reporting: from ten thousand findings to decisions
6.5	Conducting and facilitating security audits	Security audits: independence, evidence, and the finding that holds up

Domain 7 — Security Operations 13% of the exam

AI note Put AI/ML into SOAR to cut alert fatigue, and monitor production models for drift and live adversarial attacks as part of normal operations. See: AI security automation: concepts.

Objective	Topic	Lesson
7.1	Investigations: evidence, techniques, forensics	Investigations and digital forensics: the management and legal view
7.2	Logging and monitoring operations	Logging and monitoring operations: deciding what gets watched, and by whom
7.3	Configuration management	Configuration management: baselines, hardening, and catching drift
7.4	Foundational security operations concepts	Foundational security operations concepts: the principles you run on
7.5	Resource and media protection	Media protection: handling the physical object
7.6	Incident management	Incident management: the team, the escalation, and the communications
7.7	Operating detective and preventive measures	Detective and preventive measures in operation: choosing, placing, and tuning controls
7.8	Patch and vulnerability management operations	Patch and vulnerability management operations: from CVE to deployed fix
7.9	Change management	Change management: approving the change before it ships
7.10	Recovery strategies and resilience	Business continuity and disaster recovery: deciding what survives the outage
7.11	Disaster recovery processes	Business continuity and disaster recovery: deciding what survives the outage
7.12	Testing the disaster recovery plan	Business continuity and disaster recovery: deciding what survives the outage
7.13	Business continuity planning and exercises	Business continuity and disaster recovery: deciding what survives the outage
7.14	Physical security implementation	Physical security in operation: running the building's defenses day to day
7.15	Personnel safety and security concerns	Personnel safety: protecting the people, not just the accounts

Domain 8 — Software Development Security 10% of the exam

AI note AI-assisted coding ships hallucinated vulnerabilities and insecure generated snippets — catch them with AI security testing in CI/CD, and secure the ML supply chain against model hijacking and inference attacks. See: AI attacks and defenses in the build pipeline, The OWASP LLM Top 10 beyond prompt injection.

Objective	Topic	Lesson
8.1	Security in the SDLC	Secure SDLC: catching the vulnerability before it ships, Application security: concepts
8.2	Security controls in development ecosystems	Secure SDLC: catching the vulnerability before it ships, Application security: concepts
8.3	Assessing software security effectiveness	Secure SDLC: catching the vulnerability before it ships, Application security: concepts
8.4	Security impact of acquired software	Secure SDLC: catching the vulnerability before it ships, Application security: concepts
8.5	Secure coding guidelines and standards	Secure SDLC: catching the vulnerability before it ships, Application security: concepts

Keep going

The security guidebook →